OpenClaw Changes Default to Block Subagent Access to Operator Profiles

When OpenClaw spawns a subagent — a satellite worker that runs a focused task on behalf of a main controller — it has always sent five files along by default: AGENTS.md, TOOLS.md, SOUL.md, IDENTITY.md, and USER.md. Those last three are the operator's profile. They contain behavioral preferences, system directives, notes about the humans involved, and whatever context had been dropped into USER.md — potentially cloud credentials, customer data, internal notes. Until last week, every subagent inherited that profile automatically. OpenClaw v2026.5.24-beta.1, released today, makes those three files opt-in. The accountability question is concrete: what were operators sharing, and who was listening?

The change landed in PR #85283, authored by 100yenadmin and merged by Peter Steinberger. The PR's own summary: every spawned sub-agent was paying for inherited bootstrap context even when the controller already gave it a focused task. Under the old default, a team running OpenClaw to orchestrate multi-step database migrations might store cloud credentials in USER.md to give subagents environment context; every spawned worker, including transient code-generation or file-processing tasks, inherited those credentials automatically. The new default strips SOUL.md, IDENTITY.md, and USER.md from the bundle and leaves only AGENTS.md and TOOLS.md — the files that describe what the subagent is allowed to do and which tools it can use. Existing deployments are unaffected unless they explicitly configure the new field; omitting the config field preserves the old five-file default.

The security research gives the gap a sharper edge. A March 2026 arXiv preprint, "Trojan's Whisper," documented guidance injection via bootstrap files as an attack vector: a malicious or compromised bootstrap file could reshape a subagent's behavior with high success rates, and the operator would have limited visibility into the change. Researchers constructed 26 malicious skills across 13 attack categories; 94% evaded existing static and LLM-based scanners, and guidance injection attacks achieved success rates between 16% and 64.2% across 52 natural user prompts and six state-of-the-art LLM backends. CVE-2026-32922, a critical privilege escalation vulnerability (CVSS 9.9/9.4) in OpenClaw's device.token.rotate, affects over 135,000 internet-facing instances, 63% running without authentication. The CVE is a separate attack surface from the context-inheritance gap — it describes missing scope validation in device token handling — but both involve subagents receiving more context than the task required.

SEN-X framed the May 23rd beta as a security argument made through implementation. The PR author does not claim a specific breach triggered the work — the motivation appears to be token efficiency and least-privilege context design. The attack research suggests why the gap mattered structurally: when a subagent inherits rich operator context by default, the blast radius of any compromise or misconfiguration scales with the richness of that context. Stripping the default is a least-privilege move that also makes feedback cleaner — operators who need the context can opt in and know exactly what they've handed over.

The broader pattern is worth noting. OpenClaw is among the first agent frameworks to audit its bootstrap defaults under this lens — but it is not alone in shipping these defaults. Similar context-inheritance behaviors exist across LangChain, AutoGen, and CrewAI. The OpenClaw change is a signal that the ecosystem is beginning to treat bootstrap context as a security surface, not a convenience feature.

What operators should do now: audit content in SOUL.md, USER.md, and IDENTITY.md. If any of those files contain credentials, customer data, internal notes, or anything not strictly necessary for a delegated worker to do its job, that content was shared further than the task required. The fix is in v2026.5.24-beta.1, released May 24th.

Sources: GitHub PR #85283; SEN-X OpenClaw Daily, May 23rd; ARMO CVE-2026-32922 analysis; GitHub release tag v2026.5.24-beta.1; arXiv Trojan's Whisper preprint.